Documentation changes preview: https://docs-v3-preview.elastic.dev/elastic/ecs/pull/2524/reference/

🤖 GitHub comments

🔍 Preview links for changed docs

• docs/reference/ecs-allowed-values-event-type.md
• docs/reference/ecs-event.md

💚 CLA has been signed

Have you considered proposing a new value for event.type instead? It too is an array, and should accommodate the proposed "device" allowed value.

I have two concerns with adding device as a new value for event.category.

1. For ECS users in general, it may cause confusion and diversion from event.category:host which is the preferred category for all host events. (FYI, when ECS was first defined, both "system" and "device" were considered before deciding on "host".)
2. It may be difficult to identify a device action when the event.category (array) contains both host and device, with an event.type value such as info. (i.e., Which is it - host info or device info?)

If instead we extend event.type to include a new allowed value of device, then an event that had: event.kind: event event.category:host event.type: [device], [denied] event.action: usb_storage_device_blocked

would be very clear that it took place on a host, and an attempt to install a device was blocked by the EDR.

@MikePaquette this makes a lot of sense

@ricardo-estc do you think you can make the necessary changes based upon Mike's recommendations?

@MikePaquette @qcorporation done, please review the updated changes

Updated docs @MikePaquette, thank you!